{"api_version":"1","generated_at":"2026-07-23T06:57:21+00:00","cve":"CVE-2015-2959","urls":{"html":"https://cve.report/CVE-2015-2959","api":"https://cve.report/api/cve/CVE-2015-2959.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2015-2959","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2015-2959"},"summary":{"title":"CVE-2015-2959","description":"Zoho NetFlow Analyzer build 10250 and earlier does not check for administrative authorization, which allows remote attackers to obtain sensitive information, modify passwords, or remove accounts by leveraging the guest role.","state":"PUBLISHED","assigner":"jpcert","published_at":"2015-06-09 00:59:01","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-284","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://jvndb.jvn.jp/jvndb/JVNDB-2015-000075","name":"http://jvndb.jvn.jp/jvndb/JVNDB-2015-000075","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/75065","name":"http://www.securityfocus.com/bid/75065","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Zoho Corporation NetFlow Analyzer CVE-2015-2959 Security Bypass Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://jvn.jp/en/jp/JVN25598413/index.html","name":"http://jvn.jp/en/jp/JVN25598413/index.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"JVN#25598413: NetFlow Analyzer fails to restrict access permissions","mime":"text/xml","httpstatus":"200","archivestatus":"200"},{"url":"https://support.zoho.com/portal/manageengine/helpcenter/articles/vulnerability-fix-for-fails-to-restrict-access-permissions-cross-site-scripting-cross-site-request-forgery-over-build-10250","name":"https://support.zoho.com/portal/manageengine/helpcenter/articles/vulnerability-fix-for-fails-to-restrict-access-permissions-cross-site-scripting-cross-site-request-forgery-over-build-10250","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"Vulnerability fix for (fails to restrict access permissions, cross-site scripting, cross-site request forgery) over build 10250","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id/1032516","name":"http://www.securitytracker.com/id/1032516","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Zoho NetFlow Analyzer Multiple Flaw Let Remote Users Perform Administrative Actions and Conduct Cross-Site Scripting and Cross-Site Request Forgery Attacks - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-2959","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-2959","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2015","cve_id":"2959","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"zohocorp","cpe5":"manageengine_netflow_analyzer","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T05:32:20.668Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"1032516","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1032516"},{"name":"JVN#25598413","tags":["third-party-advisory","x_refsource_JVN","x_transferred"],"url":"http://jvn.jp/en/jp/JVN25598413/index.html"},{"name":"JVNDB-2015-000075","tags":["third-party-advisory","x_refsource_JVNDB","x_transferred"],"url":"http://jvndb.jvn.jp/jvndb/JVNDB-2015-000075"},{"name":"75065","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/75065"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://support.zoho.com/portal/manageengine/helpcenter/articles/vulnerability-fix-for-fails-to-restrict-access-permissions-cross-site-scripting-cross-site-request-forgery-over-build-10250"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2015-06-05T00:00:00.000Z","descriptions":[{"lang":"en","value":"Zoho NetFlow Analyzer build 10250 and earlier does not check for administrative authorization, which allows remote attackers to obtain sensitive information, modify passwords, or remove accounts by leveraging the guest role."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2016-12-29T18:57:01.000Z","orgId":"ede6fdc4-6654-4307-a26d-3331c018e2ce","shortName":"jpcert"},"references":[{"name":"1032516","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1032516"},{"name":"JVN#25598413","tags":["third-party-advisory","x_refsource_JVN"],"url":"http://jvn.jp/en/jp/JVN25598413/index.html"},{"name":"JVNDB-2015-000075","tags":["third-party-advisory","x_refsource_JVNDB"],"url":"http://jvndb.jvn.jp/jvndb/JVNDB-2015-000075"},{"name":"75065","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/75065"},{"tags":["x_refsource_CONFIRM"],"url":"https://support.zoho.com/portal/manageengine/helpcenter/articles/vulnerability-fix-for-fails-to-restrict-access-permissions-cross-site-scripting-cross-site-request-forgery-over-build-10250"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"vultures@jpcert.or.jp","ID":"CVE-2015-2959","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Zoho NetFlow Analyzer build 10250 and earlier does not check for administrative authorization, which allows remote attackers to obtain sensitive information, modify passwords, or remove accounts by leveraging the guest role."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"1032516","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1032516"},{"name":"JVN#25598413","refsource":"JVN","url":"http://jvn.jp/en/jp/JVN25598413/index.html"},{"name":"JVNDB-2015-000075","refsource":"JVNDB","url":"http://jvndb.jvn.jp/jvndb/JVNDB-2015-000075"},{"name":"75065","refsource":"BID","url":"http://www.securityfocus.com/bid/75065"},{"name":"https://support.zoho.com/portal/manageengine/helpcenter/articles/vulnerability-fix-for-fails-to-restrict-access-permissions-cross-site-scripting-cross-site-request-forgery-over-build-10250","refsource":"CONFIRM","url":"https://support.zoho.com/portal/manageengine/helpcenter/articles/vulnerability-fix-for-fails-to-restrict-access-permissions-cross-site-scripting-cross-site-request-forgery-over-build-10250"}]}}}},"cveMetadata":{"assignerOrgId":"ede6fdc4-6654-4307-a26d-3331c018e2ce","assignerShortName":"jpcert","cveId":"CVE-2015-2959","datePublished":"2015-06-09T00:00:00.000Z","dateReserved":"2015-04-07T00:00:00.000Z","dateUpdated":"2024-08-06T05:32:20.668Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2015-06-09 00:59:01","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-284","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:zohocorp:manageengine_netflow_analyzer:-:*:*:*:*:*:*:*","matchCriteriaId":"0940949F-4EB4-460B-8CE9-56B6387250F3"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2015","CveId":"2959","Ordinal":"1","Title":"CVE-2015-2959","CVE":"CVE-2015-2959","Year":"2015"},"notes":[{"CveYear":"2015","CveId":"2959","Ordinal":"1","NoteData":"Zoho NetFlow Analyzer build 10250 and earlier does not check for administrative authorization, which allows remote attackers to obtain sensitive information, modify passwords, or remove accounts by leveraging the guest role.","Type":"Description","Title":"CVE-2015-2959"},{"CveYear":"2015","CveId":"2959","Ordinal":"2","NoteData":"2015-06-08","Type":"Other","Title":"Published"},{"CveYear":"2015","CveId":"2959","Ordinal":"3","NoteData":"2016-12-29","Type":"Other","Title":"Modified"}]}}}